Strengthening Medicaid Program Integrity
What We Found
The Centers for Medicare & Medicaid Services has taken steps, but further efforts are needed to reduce improper payments, ensure the appropriate use of program dollars, and improve program data.

Since our 2019 High-Risk Report, our assessment for all five criteria remains unchanged. The Centers for Medicare & Medicaid Services (CMS) continues to demonstrate leadership support to address risks in the areas of: (1) improper payments, (2) appropriate use of Medicaid dollars by the states, and (3) Medicaid data. Still, work remains to fully meet all of the high-risk criteria. As of December 2020, 89 of our more than 300 recommendations for Medicaid remain open, and several major steps remain to improve program integrity.
Improper Payments

Since our 2019 High-Risk Report, all five criteria remain unchanged.
Leadership commitment: met. CMS continues to demonstrate commitment to oversight of improper payments. In June 2018, CMS communicated the agency’s strategy for improving program integrity, including plans for a number of new efforts to detect and respond to improper payments, including enhanced auditing efforts.
As of July 2020, CMS has continued to take important steps in implementing the strategy, such as (1) starting to audit beneficiary eligibility determinations and managed care payments, and (2) conducting outreach to state auditors as a means of expanding its oversight of improper payments.
Capacity: partially met. CMS continues to take actions to enhance the resources and guidance available to states for program integrity purposes. In July 2019, CMS met with audit contractors to discuss coordination of managed care audits. As a result of the feedback and recommendations received, CMS is evaluating several process improvements and reiterated that audit contractors will continue to work with states to provide support and assistance in Medicaid managed care.
However, it is unclear if these actions will (1) remove known impediments to managed care audits, or (2) increase the number of collaborative audits.
Additionally, one-third of Medicaid improper payments relate to states’ noncompliance with provider screening and enrollment requirements. We reported in October 2019 that CMS has targeted resources to support and oversee states’ implementation efforts through optional contractor site visits and a triennial improper payments review, among other activities. However, because these efforts are optional or focus on specific areas, they do not provide a comprehensive review of provider enrollment and screening. Without an expansion of CMS’s review to include all states, these efforts do not provide sufficiently comprehensive or timely oversight.
Action plan: partially met. In June 2018, CMS outlined a strategy to reduce Medicaid improper payments, which included planned actions that could address some of the concerns we raised in January 2017 and May 2018. However, as of July 2020, CMS (1) still has not detailed the scope and timing of this strategy, including implementation dates; nor (2) indicated how it will use information from other auditors to inform its oversight. Additionally, CMS has not stated when it will integrate state improper payment rates in the Medicaid Scorecard, used to report CMS and state performance in administering Medicaid.
Monitoring: partially met. Although CMS has taken steps to improve its monitoring of managed care overpayments by requiring states to report additional information, our work has identified ongoing concerns related to CMS’s monitoring of improper payments, particularly with regard to identifying and targeting risk.
As we reported in March 2019, CMS has generally more stringent documentation requirements for Medicare than Medicaid for the same services. These inconsistent requirements result in disparities between the programs in identifying improper payments resulting from insufficient documentation. They also raise questions about how well CMS is identifying and addressing program risks in both programs.
Additionally, gaps exist in CMS’s efforts to oversee states’ compliance with third-party liability requirements, which help assure that Medicaid remains the payer of last resort for services for children subject to child support enforcement. As we reported in August 2019, CMS provided incorrect guidance to states about the requirements and did not verify that the states had implemented measures to seek third-party payment for pediatric services.
Demonstrated progress: partially met. While CMS’s overall estimated Medicaid improper payment rate increased from 14.9 percent in fiscal year 2019 to 21.4 percent in fiscal year 2020, the increase was driven in part by a component that had not been measured until 2019. The improper payment rate is comprised of three components: (1) fee-for-service payments to providers, (2) payments to managed care organizations (MCO), and (3) the accuracy of beneficiary eligibility determinations.
The increase in the overall error rate reflects an increase in the beneficiary eligibility component, which was held at the 2014 rate of 3.1 percent through 2018 to allow for revision of the review and increased from 8.4 percent in 2019, when the review resumed, to 14.9 percent in 2020. In addition to the revised review methodology, CMS attributes the 2020 error rate to insufficient documentation to verify beneficiary eligibility and states’ noncompliance with redetermination requirements.
The managed care component of the error rate, which decreased in 2020, continues to not account for all program risks. As we found in our May 2018 report, CMS’s estimates of MCO improper payments do not include a medical review of services or reviews of MCO records or data. We have noted that many entities—such as state auditors—play an important role in ensuring program integrity, and that further collaboration with these stakeholders could address gaps in managed care audits, among other areas.
Appropriate Use of Medicaid Dollars

Since our 2019 High-Risk Report, all five criteria remain unchanged. Our work continues to identify risks related to CMS oversight of whether states’ use of Medicaid funds is consistent with Medicaid requirements.
Leadership commitment: partially met. CMS has taken steps to ensure appropriate use of funds in some areas of the program, but progress was limited in other areas. CMS continues to implement its 2016 policy to better ensure that Medicaid demonstrations—which allow states to test new approaches to providing coverage and for delivering services—are budget neutral (i.e., that the demonstrations do not increase federal costs). CMS has also indicated its intention to revise policies for reviewing proposed changes to existing demonstrations, as we recommended in April 2019, to improve transparency around the potential effects of those changes. However, the budget neutrality policy still permits the use of questionable methods—such as hypothetical rather than actual expenditures—to set demonstration spending limits.
In November 2020, CMS removed a proposed rule from the Unified Agenda of Federal Regulatory and Deregulatory Action, which identifies the rulemakings that are planned or underway throughout the federal government. The proposed rule, if finalized, would have required states to report additional information about Medicaid financing arrangements (which can increase federal spending without a commensurate increase in state spending) and supplemental payments (payments made to providers in addition to claims-based payments).
We have made several recommendations over the last several years related to improving oversight of financing and supplemental payments. We also maintain that additional state reporting in these areas is necessary to ensure that CMS has the information it needs to verify that these payments are being made for Medicaid purposes in an economical and efficient manner.
In December 2020, Congress passed and the President signed into law legislation requiring additional state reporting on supplemental payments, including requiring states to describe how these payments are consistent with economy and efficiency. The effectiveness of these new reporting requirements will depend on how CMS implements them.
Capacity: partially met. CMS has taken actions toward building oversight capacity, but has pulled back on other efforts that held promise. In November 2019, CMS reorganized some of its regional office functions, including financial oversight, in an effort to ensure that financial operations are consistent across the nation. This reorganization ended other assessments of oversight capacity and risk.
Specifically, CMS had developed a standard tool in October 2019 to assess risk and staff capacity for oversight of states’ reported expenditures. CMS planned to conduct a national assessment of whether oversight resources are adequate and target areas of greatest risk as we recommended. However, CMS suspended further efforts to develop and use this tool in November 2019 when it completed the reorganization.
Action plan: partially met. CMS continues to implement policy changes to ensure budget neutrality of demonstrations with the next significant change scheduled to begin in 2021. The timing for other planned actions is unclear. For example, CMS has not made progress on an action plan for oversight of supplemental payments.
Also, CMS has no specific plan for considering the adequacy and allocation of resources for expenditure oversight. It is, instead, taking the approach of assessing the allocation of resources on an ongoing basis despite our findings that resources were not well targeted to the areas of greatest risk.
Monitoring: partially met. For demonstrations, CMS continues to assess the effect of its new budget neutrality policy with the renewal of each demonstration. In January 2020, agency officials told us that CMS had developed a reporting tool for states that will allow for monitoring the policy over time. As of December 2020, the agency has implemented the tool, but it is unclear whether the agency is consistently enforcing reporting requirements.
For supplemental payments, CMS continues to lack a strategy for systematically identifying questionable payments to states for their supplemental payment programs that may not be clearly linked to Medicaid purposes. In December 2020, we reported that states’ reliance on provider taxes and local government funds effectively increased the share of Medicaid payments financed by the federal government by an estimated 5 percentage points to 68 percent in 2018. This shift in the federal share of Medicaid spending was greater for supplemental payments, with the federal government financing 76 percent of certain supplemental payments in 2018.
CMS does not collect consistent or sufficient information on states’ Medicaid payments and the sources of funds states use to finance the nonfederal share. As a result, CMS cannot adequately determine whether payments are consistent with economy and efficiency and financed with permissible sources of funds.
Demonstrated progress: partially met. With regard to oversight of demonstration spending, CMS’s revised 2016 budget neutrality policy reduced total demonstration spending limits by an estimated $159.5 billion for 2016 through 2019, the federal share—59.6 percent—of which is $95.1 billion. Another new budget neutrality policy will take effect for demonstrations renewed on or after January 1, 2021—which should further reduce federal liabilities. However, CMS has not made significant progress towards improving its oversight of supplemental payments, for which reporting remains incomplete.
Medicaid Data

Since our 2019 High-Risk Report, the leadership commitment criterion has progressed from partially met to met and the action plan criterion has progressed from not met to partially met. Ratings for the remaining three criteria remain unchanged. CMS has demonstrated the leadership support needed to address Medicaid data quality. However, our work continues to identify the need for CMS to take additional steps to improve Medicaid data quality and to expedite the use of improved data for program oversight.
Leadership commitment: met. CMS’s ongoing efforts to implement the Transformed Medicaid Statistical Information System (T-MSIS) reflect the agency’s commitment to improve Medicaid data, such as Medicaid eligibility and claims data. As of December 2019, all 50 states, the District of Columbia, and two U.S. territories were submitting data to all eight T-MSIS files. CMS uses a dashboard to share data errors with states and provides states with ongoing technical assistance. CMS also publicly released excerpts of 2016 T-MSIS data and issued corresponding data quality briefs that provide insight on their usability for research and oversight.
In September 2020, CMS released similar data for calendar years 2017 and 2018. These efforts have contributed to improvements in the completeness and accuracy of T-MSIS data compared to what we found in December 2017. In October 2020 we found T-MSIS data sufficiently reliable for use to report on the number of individuals eligible for Medicaid through the Breast and Cervical Cancer Prevention and Treatment Act of 2000. CMS has also used T-MSIS data for targeted research and oversight efforts and is committed to expand such efforts with further improvements in T-MSIS data quality.
Capacity: partially met. CMS revised the state Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) data submission process, providing states with the option of having CMS use T-MSIS data to document EPSDT services on states’ behalf beginning in 2021. CMS also updated its Encounter Data Toolkit in August 2019, which set voluntary guidelines for states to follow when validating MCO claims—known as encounter data.
However, CMS has not provided states with information about how to conduct an independent audit of encounter data or about how to provide CMS with an annual assessment of these data. Without establishing requirements for these processes, CMS efforts to perform effective oversight of encounter data reliability will be limited.
Action plan: partially met. In December 2017, we recommended that CMS develop a plan and time frame for using T-MSIS data for oversight. In January 2021, we report that CMS has begun using T-MSIS data for oversight, including a reporting on the number of beneficiaries receiving substance use disorder services in 2017 and a preliminary analysis of foregone care by children enrolled in Medicaid and the Children’s Health Insurance Program during the Coronavirus Disease 2019 pandemic. However, CMS has not provided a plan for use of T-MSIS data for broad program oversight.
In August 2019, we specifically recommended that CMS develop a plan with time frames to use T-MSIS data to improve EPSDT oversight and streamline state reporting. In June 2020, CMS told us that the agency has begun to use T-MSIS data to recreate certain EPSDT measures from a prior year and will then validate the data. CMS did not provide a time frame for completing this effort or specify when it will begin to use T-MSIS data for EPSDT oversight.
Monitoring: partially met. In August 2019 we recommended that CMS work with states and relevant federal agencies to collect accurate and complete data on blood lead screening for beneficiaries to ensure that CMS can monitor state compliance with its blood lead screening policy.
In June 2020, CMS said it will use T-MSIS data rather than a separate data request to monitor blood lead screening upon state request, but that data limitations hinder agency efforts to obtain complete data on blood lead screening for children enrolled in Medicaid. As a result, CMS’s oversight of blood lead screening for children in Medicaid will be limited, leaving children vulnerable to lead exposure that can cause developmental delays and harm to nearly every body system.
Demonstrated progress: partially met. The ongoing implementation of T-MSIS has been a significant, multiyear effort. CMS continues to take steps to assess and improve data quality. CMS identified 32 top priority items that are critical for program oversight, including data related to beneficiary and provider eligibility and MCO reporting. CMS established standards for each of these items and monitors states’ progress in submitting data that meet them.
CMS notifies states of their compliance status with these priority items and can require states to submit state plans of action to correct areas of noncompliance. In January 2021, we reported that states’ data submissions have improved steadily for most of these items. States continue to face challenges reporting accurate information for certain priority items, such as items related to MCO payments and services, underscoring the need for improvement.
The size, growth, and diversity of the federal-state Medicaid program present oversight challenges. We designated Medicaid a high-risk program in 2003.
In fiscal year 2020, Medicaid covered an estimated 77 million low-income and medically needy individuals at a cost of $673 billion, of which $419 billion was financed by the federal government. Services are increasingly delivered through managed care, under which organizations are paid a set amount per beneficiary to provide or arrange for care.
Our recent work highlights the following:
(1) Medicaid improper payments represented about 21.4 percent of federal program spending—more than$85 billion—in fiscal year 2020, an increase of nearly $30 billion from 2019.
(2) States have increased their reliance on provider taxes and local governments to finance the nonfederal share of Medicaid spending, particularly for supplemental payments to providers. These payments are not linked to claims for beneficiary services and represent a growing share of Medicaid spending, totaling more than $46.3 billion in 2017, the most recent year for which data are available.
(3) CMS’s oversight of Medicaid often relies on state-reported expenditure and utilization data. Incomplete and inconsistent state data complicate program oversight.
Improper Payments
Since designating Medicaid as a high-risk area in 2003, we have made at least 55 recommendations related to improper payments, 18 of which were open as of December 2020. To reduce improper payments, CMS needs to, among other things,
- expand its review of states' implementation of provider screening and enrollment requirements to include states that have not participated in optional contractor site visits; and for states not fully compliant with the requirements, annually monitor their implementation progress;
- assess and ensure, as appropriate, that Medicare and Medicaid documentation requirements are necessary and effective at demonstrating compliance with coverage policies while appropriately addressing program risks;
- develop and implement time frames to ensure that the agency completes financial management reviews in a timely manner; and
- expand audit coverage in managed care.
Appropriate Use of Medicaid Dollars
Since designating Medicaid as a high-risk area in 2003, we have made at least 61 recommendations related to the appropriate use of program dollars, 21 of which were open as of December 2020. CMS needs to take the following steps, among others, to better assure the appropriate use of Medicaid dollars:
- address questionable methods—particularly relying on hypothetical rather than actual expenditures—used to set demonstration spending limits; develop and document standard operating procedures for monitoring demonstration spending; and develop policies for ensuring transparency when states submit major changes to pending demonstration applications or propose changes to existing demonstrations.
- collect sufficient provider specific information from states on Medicaid payments and the sources of funds states use to finance their share of Medicaid payments; outline clear criteria, data, and a review process to ensure payments are economical and efficient; and write guidance clarifying its policy that requires a link between the distribution of supplemental payments and Medicaid-covered services; and
- complete a risk assessment and take steps, as needed, to assure that resources to oversee expenditures reported by states are adequate and allocated according to risk.
Congressional Actions Needed
Congressional action could improve oversight of Medicaid expenditures.
- In January 2008, we suggested Congress consider establishing statutory requirements for the Secretary of the Department of Health and Human Services to improve the demonstration review process to more clearly outline the methods used to demonstrate budget neutrality.
Medicaid Data
Since designating Medicaid as a high-risk area in 2003, we have made at least 42 recommendations related to Medicaid data, 15 of which were open as of December 2020. To improve the quality of Medicaid data for use in program oversight, CMS needs to, among other things:
- continue efforts to assess and improve T-MSIS data and articulate specific plans and associated time frames for using T-MSIS data for broad program oversight; and
- provide states with information on: (1) scope and methodology requirements for MCO encounter data audits, (2) required content of the annual assessment report, and (3) circumstances under which federal matching funds can be deferred or disallowed in response to noncompliant encounter data submissions.
